From traxtopel at gmail.com  Tue Jul  4 05:14:50 2023
From: traxtopel at gmail.com (traxtopel at gmail.com)
Date: Tue, 04 Jul 2023 14:14:50 +0200
Subject: csd-post.sh "You are attempting to use a digital certificate
 not assigned to this device"
In-Reply-To: <CAOw_LSE+8vN781F8jS8n43pexJRSMmy=FSwKqxqv4yXt+Ggxtw@mail.gmail.com>
References: <CACNAWW9fpvJEK1m3khbxxt86BfXMxSWqSRyRGXWMwEOFH1cgAw@mail.gmail.com>
	 <CAOw_LSE+8vN781F8jS8n43pexJRSMmy=FSwKqxqv4yXt+Ggxtw@mail.gmail.com>
Message-ID: <7591dd2a818e32352f644f84de4f24dd23dab7bc.camel@gmail.com>


Hi Daniel,
as part of our many layers of security we have a policy to limit access
to the registered MAC addresses. As a result, I am utilizing this patch
to csd-post.sh. This might be useful to somebody else.

--- csd-post.sh.orig	2023-07-04 14:08:44.835890581 +0200
+++ csd-post.sh	2023-07-04 14:11:16.054802224 +0200
@@ -12,6 +12,23 @@
 # server's security policy with lies. This script exists as an example
 # to work from.
 
+if openssl version|awk '{ print $2 }' | grep -Eq '^3'; then
+    OPENSSL_CONF_FILE=$(mktemp)
+    cat << EOF > $OPENSSL_CONF_FILE
+openssl_conf = openssl_init
+
+[openssl_init]
+ssl_conf = ssl_sect
+
+[ssl_sect]
+system_default = system_default_sect
+
+[system_default_sect]
+Options = UnsafeLegacyRenegotiation
+EOF
+    export OPENSSL_CONF=$OPENSSL_CONF_FILE
+fi
+
 if ! xmlstarlet --version > /dev/null 2>&1; then
     echo
"**********************************************************************
**" >&2
     echo "WARNING: xmlstarlet not found in path; CSD token extraction
may not work" >&2
@@ -32,12 +49,45 @@
     echo
"*********************************************************************"
>&2
 fi
 
+USE_MACHINE_MAC=true
+if [[ "$USE_MACHINE_MAC" == "true" ]]; then
+    # Function to convert MAC address to the format FFFF.FFFF.FFFF
+    convert_mac_address() {
+        local mac_address=$1
+        echo "${mac_address//:}" | sed 's/^\([0-9A-Fa-f]\{4\}\)\([0-
9A-Fa-f]\{4\}\)\([0-9A-Fa-f]\{4\}\).*$/\1.\2.\3/'
+    }
+    macaddresses=()
+
+    while IFS= read -r -d '' device; do
+        device_name=$(basename "$device")
+        if [[ ! $device_name =~ (tap|virbr|lo|vpn) ]]; then
+            address_file="$device/address"
+            if [[ -f $address_file ]]; then
+                macaddress=$(< "$address_file")
+                macaddresses+=("$(convert_mac_address "$macaddress")")
+            fi
+        fi
+    done < <(find "/sys/class/net" -mindepth 1 -print0)
+
+    # Convert each value to the format FFFF.FFFF.FFFF
+    converted_values=""
+    IFS='|' read -ra value_array <<< "$values"
+    for value in "${macaddresses[@]}"; do
+        converted_value=$(convert_mac_address "$value")
+       
converted_values+="endpoint.device.MAC[\"$converted_value\"]=\"true\";\
n"
+    done
+
+    # Print the converted values
+    mac_address=$(echo -e "$converted_values" | sed '$ s/.$//')
+
+else
+    mac_address='endpoint.device.MAC["FFFF.FFFF.FFFF"]="true";'
+fi
 
 export RESPONSE=$(mktemp /tmp/csdresponseXXXXXXX)
 export RESULT=$(mktemp /tmp/csdresultXXXXXXX)
 trap 'rm $RESPONSE $RESULT' EXIT
 
-
 cat >> $RESPONSE <<EOF
 endpoint.os.version="$(uname -s)";
 endpoint.os.servicepack="$(uname -r)";
@@ -46,26 +96,7 @@
 endpoint.device.protection="none";
 endpoint.device.protection_version="3.1.03103";
 endpoint.device.hostname="$(hostname)";
-endpoint.device.port["9217"]="true";
-endpoint.device.port["139"]="true";
-endpoint.device.port["53"]="true";
-endpoint.device.port["22"]="true";
-endpoint.device.port["631"]="true";
-endpoint.device.port["445"]="true";
-endpoint.device.port["9216"]="true";
-endpoint.device.tcp4port["9217"]="true";
-endpoint.device.tcp4port["139"]="true";
-endpoint.device.tcp4port["53"]="true";
-endpoint.device.tcp4port["22"]="true";
-endpoint.device.tcp4port["631"]="true";
-endpoint.device.tcp4port["445"]="true";
-endpoint.device.tcp4port["9216"]="true";
-endpoint.device.tcp6port["139"]="true";
-endpoint.device.tcp6port["53"]="true";
-endpoint.device.tcp6port["22"]="true";
-endpoint.device.tcp6port["631"]="true";
-endpoint.device.tcp6port["445"]="true";
-endpoint.device.MAC["FFFF.FFFF.FFFF"]="true";
+$mac_address
 endpoint.device.protection_extension="3.6.4900.2";
 endpoint.fw["IPTablesFW"]={};
 endpoint.fw["IPTablesFW"].exists="true";
@@ -74,6 +105,14 @@
 endpoint.fw["IPTablesFW"].enabled="ok";
 EOF
 
+for port in 9217 139 53 22 631 445 9216; do
+    cat >> $RESPONSE <<EOF ;
+endpoint.device.port["$port"]="true";
+endpoint.device.tcp4port["$port"]="true";
+endpoint.device.tcp6port["$port"]="true";
+EOF
+done
+
 shift
 
 TICKET=
@@ -174,5 +213,6 @@
 curl $PINNEDPUBKEY -s -H "$CONTENT_HEADER" -H "$COOKIE_HEADER" -H
'Expect: ' --data-binary @$RESPONSE "$URL" > $RESULT
 
 cat $RESULT || :
+[ -f $OPENSSL_CONF_FILE ] && rm =f $OPENSSL_CONF_FILE
 
 exit 0

On Fri, 2023-06-30 at 11:09 -0700, Daniel Lenski wrote:
> On Mon, Jun 26, 2023 at 4:56?AM Grant Williamson
> <traxtopel at gmail.com> wrote:
> > I'm encountering an issue with the csd-post.sh script. When
> > attempting
> > to use it, I receive the error message: "You are attempting to use
> > a
> > digital certificate not assigned to this device." I would
> > appreciate
> > any insights on how to add support for when a server cross checks
> > the
> > MAC address functionality in the script.
> 
> > Helps if I just try using what is there. Sorry.
> > endpoint.device.MAC["FFFF.FFFF.FFFF"]="true";
> 
> Glad you figured out, but? wow.
> 
> "Digital certificate not assigned to this device" is a very
> misleading/unclear/irrelevant error message for "you didn't tell us
> your MAC address."
> 
> Unfortunately, OpenConnect has encountered many such similar cases
> where VPN servers send vague/misleading error messages when they
> reach
> an unexpected state
> (
> https://gitlab.com/openconnect/openconnect/-/blob/master/gpst.c#L672-
> 676).
> It appears that their developers and administrators only test them
> against their official clients, and don't consider what would happen
> if a different client sent a different set of information.
> 
> (Needless to say, these kinds of flawed assumptions are also a rich
> source of security vulnerabilities. ?)


From dwmw2 at infradead.org  Tue Jul  4 05:51:59 2023
From: dwmw2 at infradead.org (David Woodhouse)
Date: Tue, 04 Jul 2023 13:51:59 +0100
Subject: csd-post.sh "You are attempting to use a digital certificate
 not assigned to this device"
In-Reply-To: <CAOw_LSE+8vN781F8jS8n43pexJRSMmy=FSwKqxqv4yXt+Ggxtw@mail.gmail.com>
References: <CACNAWW9fpvJEK1m3khbxxt86BfXMxSWqSRyRGXWMwEOFH1cgAw@mail.gmail.com>
	 <CAOw_LSE+8vN781F8jS8n43pexJRSMmy=FSwKqxqv4yXt+Ggxtw@mail.gmail.com>
Message-ID: <f27f6d1c90c9881807f23b0c6d1b2077c4fd5945.camel@infradead.org>

On Fri, 2023-06-30 at 11:09 -0700, Daniel Lenski wrote:
> On Mon, Jun 26, 2023 at 4:56?AM Grant Williamson <traxtopel at gmail.com> wrote:
> > I'm encountering an issue with the csd-post.sh script. When attempting
> > to use it, I receive the error message: "You are attempting to use a
> > digital certificate not assigned to this device." I would appreciate
> > any insights on how to add support for when a server cross checks the
> > MAC address functionality in the script.
> 
> > Helps if I just try using what is there. Sorry.
> > endpoint.device.MAC["FFFF.FFFF.FFFF"]="true";
> 
> Glad you figured out, but? wow.
> 
> "Digital certificate not assigned to this device" is a very
> misleading/unclear/irrelevant error message for "you didn't tell us
> your MAC address."

To be fair, we *did* tell it our MAC address. We just *lied* and told
it our MAC address was FF:FF:FF:FF:FF:FF. While using a certificate
assigned to some other device.

Using a MAC address as the host identifier isn't that unusual (although
it does have issues when you have multiple devices, and it's better to
use the system UUID from /etc/machine-id where it exists).


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5965 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20230704/8217aa83/attachment.p7s>

From mastaudig at googlemail.com  Sat Jul  8 02:11:47 2023
From: mastaudig at googlemail.com (Martin Staudigel)
Date: Sat, 8 Jul 2023 11:11:47 +0200
Subject: OpenConnect problems after updating to debian bookworm
Message-ID: <0c5e43d3-e799-fec9-963f-695f4b3cbb55@gmail.com>


Hello,

I recently updated my (Debian) os, which included an update from
openvpn/oldstable,now 2.5.1-3 amd64 [installed] to
openvpn/stable,now 2.6.3-1 amd64 [installed,automatic]

I became aware, that my vpn connection, using Protocol Cisco AnyConnect 
or OpenConnect via NetworkManager does not work anymore. When connecting 
with openvpn on cli using the --no-xmlpost parameter the connction could 
be established.

Using 2.6.3-1 without parameter results in the following connection log:

[code]
$>sudo openconnect -v --protocol=anyconnect [SERVER]/[PATH]

POST https://[SERVER]/[PATH]
Attempting to connect to server [IP]:443
Connected to [IP]:443
SSL negotiation with [SERVER]
Connected to HTTPS on [SERVER] with ciphersuite 
(TLS1.2)-(ECDHE-SECP256R1)-(RSA-SHA512)-(AES-256-GCM)
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-store
Pragma: no-cache
Connection: Keep-Alive
Date: Sun, 02 Jul 2023 17:15:20 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' 'unsafe-inline' 
'unsafe-eval' data: blob:; frame-ancestors 'self'
X-Aggregate-Auth: 1
HTTP body chunked (-2)
XML POST enabled
[/Code]

This is where the credentials have to be entered.
After doing this, the result is something like this:

[Code]
POST https://[SERVER]/
Got HTTP response: HTTP/1.1 404 Not Found
Cache-Control: no-store
Pragma: no-cache
Connection: Close
Date: Sun, 02 Jul 2023 17:15:54 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' 'unsafe-inline' 
'unsafe-eval' data: blob:; frame-ancestors 'self'
HTTP body http 1.0 (-1)
TLS/DTLS socket closed uncleanly
Unexpected 404 result from server
Failed to complete athentication
[/Code]

Using the --no-xmlpost option the connect log looks like this.

[code]
$>sudo openconnect -v --protocol=anyconnect --no-xmlpost [SERVER]/[PATH]

POST https://[SERVER]/[PATH]
Attempting to connect to server [IP]:443
Connected to [IP]:443
SSL negotiation with [SERVER]
Connected to HTTPS on [SERVER] with ciphersuite 
(TLS1.2)-(ECDHE-SECP256R1)-(RSA-SHA512)-(AES-256-GCM)
Got HTTP response: HTTP/1.0 302 Temporary moved
Set-Cookie: tg=0VEdfTUlLX09UUA==; path=/; secure
Content-Length: 0
Cache-Control: no-store
Pragma: no-cache
Connection: Close
Date: Sun, 02 Jul 2023 17:56:38 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' 'unsafe-inline' 
'unsafe-eval' data: blob:; frame-ancestors 'self'
Location: /+webvpn+/index.html
HTTP body length:  (0)
GET https://[SERVER]/[PATH]
Attempting to connect to server [IP]:443
Connected to [IP]:443
SSL negotiation with [SERVER]
Connected to HTTPS on [SERVER] with ciphersuite 
(TLS1.2)-(ECDHE-SECP256R1)-(RSA-SHA512)-(AES-256-GCM)
Got HTTP response: HTTP/1.0 302 Temporary moved
Set-Cookie: tg=0VEdfTUlLX09UUA==; path=/; secure
Content-Length: 0
Cache-Control: no-store
Pragma: no-cache
Connection: Close
Date: Sun, 02 Jul 2023 17:56:38 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' 'unsafe-inline' 
'unsafe-eval' data: blob:; frame-ancestors 'self'
Location: /+webvpn+/index.html
HTTP body length:  (0)
GET https://[SERVER]/+webvpn+/index.html
SSL negotiation with [SERVER]
Connected to HTTPS on [SERVER] with ciphersuite 
(TLS1.2)-(ECDHE-SECP256R1)-(RSA-SHA512)-(AES-256-GCM)
Got HTTP response: HTTP/1.1 200 OK
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' 'unsafe-inline' 
'unsafe-eval' data: blob:; frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/xml; charset=utf-8
Cache-Control: no-store
Set-Cookie: webvpn=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpn_as=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; 
secure
Set-Cookie: webvpnc=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; secure
Set-Cookie: webvpnlogin=1; secure
X-Transcend-Version: 1
HTTP body chunked (-2)
[/Code]

...authentification follows.

[Code]
POST https://[Server]/+webvpn+/index.html
Got HTTP response: HTTP/1.1 200 OK
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' 'unsafe-inline' 
'unsafe-eval' data: blob:; frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/xml; charset=utf-8
Cache-Control: no-store
Set-Cookie: webvpnlogin=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; 
secure
Set-Cookie: webvpn_as=; expires=Thu, 01 Jan 1970 22:00:00 GMT; path=/; 
secure
Set-Cookie: samlPreauthSessionHash=; expires=Thu, 01 Jan 1970 22:00:00 
GMT; path=/; secure
Set-Cookie: acSamlv2Token=; expires=Thu, 01 Jan 1970 22:00:00 GMT; 
path=/; secure
Set-Cookie: acSamlv2Error=; expires=Thu, 01 Jan 1970 22:00:00 GMT; 
path=/; secure
Set-Cookie: webvpn=<elided>; path=/; secure
Set-Cookie: webvpnc=[Content removed]
Set-Cookie: webvpnx=
Set-Cookie: webvpnaac=1; path=/; secure
X-Transcend-Version: 1
HTTP body chunked (-2)
TCP_INFO rcv mss 1448, snd mss 1448, adv mss 1448, pmtu 1500
Got CONNECT response: HTTP/1.1 200 OK
X-CSTP-Version: 1
X-CSTP-Protocol: Copyright (c) 2004 Cisco Systems, Inc.
X-CSTP-Address: [some IPv4]
X-CSTP-Netmask: 255.255.252.0
X-CSTP-Address-IP6: [some IPv6]
X-CSTP-Hostname: [Server]
X-CSTP-DNS: [some IPv4]
X-CSTP-DNS: [some IPv4]
X-CSTP-Lease-Duration: 72000
X-CSTP-Session-Timeout: 72000
X-CSTP-Session-Timeout-Alert-Interval: 60
X-CSTP-Session-Timeout-Remaining: 72000
X-CSTP-Idle-Timeout: 1800
X-CSTP-Disconnected-Timeout: 1800
X-CSTP-Default-Domain: [Domain]
X-CSTP-Split-Include: [some IPv4]/255.255.0.0
X-CSTP-Split-Include: [some IPv4]/255.240.0.0
X-CSTP-Split-Include-IP6: [some IPv6]/48
X-CSTP-Split-Include-IP6: [some IPv6]/48
X-CSTP-Keep: true
X-CSTP-Tunnel-All-DNS: true
X-CSTP-DPD: 30
X-CSTP-Keepalive: 20
[/Code]

As I read in the manpage of OpenConnect: "If you find that you need
to use this option, then you have found a bug in OpenConnect.
Please see https://www.infradead.org/openconnect/mail.html and
report this to the developers."

So here is my report. Hopefully I gave you all the information that you 
need. If not, I'm happy to provide some more logs or debug output, I 
just have to know exactly what.

Thanks for your efforts an the good work, regards,

Martin


From traxtopel at gmail.com  Fri Jul 14 02:03:29 2023
From: traxtopel at gmail.com (Grant Williamson)
Date: Fri, 14 Jul 2023 11:03:29 +0200
Subject: Networkmanager-openconnect patch to support openconnect binary
 parameters v2
Message-ID: <CACNAWW9Qh3hZufD4icutH3RvADGDCAF+BETYDdS7DarjB_ehNQ@mail.gmail.com>

I have made modifications to my patch, which could be beneficial for
others. It enables you to pass parameters to openconnect when using
the UI. To use this, as an example add the following line to the file
/etc/nm-openconnect/openconnect.ini:
ARGS="--no-xmlpost --force-dpd=5 --no-dtls"
Then attempt to connect using the UI.

diff -ur NetworkManager-openconnect-1.2.10.orig/src/nm-openconnect-service.c
NetworkManager-openconnect-1.2.10/src/nm-openconnect-service.c
--- NetworkManager-openconnect-1.2.10.orig/src/nm-openconnect-service.c
2023-05-10 12:10:35.000000000 +0200
+++ NetworkManager-openconnect-1.2.10/src/nm-openconnect-service.c
2023-06-27 15:32:23.743747314 +0200
@@ -41,6 +41,7 @@
 #include <pwd.h>
 #include <grp.h>
 #include <locale.h>
+#include <glib.h>

 #include "nm-utils/nm-shared-utils.h"
 #include "nm-utils/nm-vpn-plugin-macros.h"
@@ -581,6 +582,95 @@
  g_ptr_array_add (openconnect_argv, (gpointer) "--verbose");
  }

+  // Allow for arguments to be added via a system file
+  const char* allowedArgs[] = {
+    "-d",
+    "--deflate",
+    "-D",
+    "--no-deflate",
+    "--compression=",
+    "--force-dpd=",
+    "--external-browser=",
+    "-i",
+    "--interface=",
+    "-l",
+    "--syslog",
+    "--timestamp",
+    "--passtos",
+    "--base-mtu=",
+    "-P",
+    "--proxy=",
+    "--proxy-auth=",
+    "--no-proxy",
+    "--libproxy",
+    "-Q",
+    "--queue-len=",
+    "-v",
+    "--verbose",
+    "--disable-ipv6",
+    "--dtls-ciphers=",
+    "--dtls12-ciphers=",
+    "--dump-http-traffic",
+    "--pfs",
+    "--no-dtls",
+    "--no-http-keepalive",
+    "--no-passwd",
+    "--no-external-auth",
+    "--allow-insecure-crypto",
+    "--non-inter",
+    "--protocol=",
+    "--useragent=",
+    "--version-string=",
+    "--no-xmlpost",
+    "--local-hostname="
+  };
+  char systemCommand[MAX_ARGS_LENGTH];
+  FILE *file = fopen("/etc/nm-openconnect/openconnect.ini", "r");
+  if (file != NULL) {
+    char args[MAX_ARGS_LENGTH];
+    while (fgets(args, sizeof(args), file)) {
+      // Skip lines starting with '#'
+      if (args[0] == '#') {
+        continue;
+      }
+      if (strncmp(args, "ARGS=", 5) == 0) {
+        memmove(args, args + 5, strlen(args) - 5 + 1);
+        char *quoteStart = strchr(args, '\"');
+        if (quoteStart != NULL) {
+          char *quoteEnd = strchr(quoteStart + 1, '\"');
+          if (quoteEnd != NULL) {
+            memmove(quoteStart, quoteStart + 1, quoteEnd - quoteStart);
+            quoteEnd[-1] = '\0';
+          }
+        }
+        char *token;
+        char *delimiter = " ";
+        token = strtok(args, delimiter);
+        while (token != NULL) {
+          // Check if the argument is in the allowedArgs list
+          int i;
+          int allowed = 0;
+          for (i = 0; i < sizeof(allowedArgs) / sizeof(allowedArgs[0]); i++) {
+            if (strncmp(token, allowedArgs[i], strlen(allowedArgs[i])) == 0) {
+              allowed = 1;
+              break;
+            }
+          }
+          if (allowed) {
+            printf("Adding argument: %s\n", token);
+            // Add the argument to the desired data structure (e.g.,
g_ptr_array_add)
+            g_ptr_array_add (openconnect_argv, token);
+          } else {
+            printf("Skipping disallowed argument: %s\n", token);
+          }
+          token = strtok(NULL, delimiter);
+        }
+        break;  // Exit the loop after processing the valid argument line
+      }
+    }
+    fclose(file);
+  }
+  //
  g_ptr_array_add (openconnect_argv, NULL);

  if (!g_spawn_async_with_pipes (NULL, (char **) openconnect_argv->pdata, NULL,
diff -ur NetworkManager-openconnect-1.2.10.orig/src/nm-openconnect-service.h
NetworkManager-openconnect-1.2.10/src/nm-openconnect-service.h
--- NetworkManager-openconnect-1.2.10.orig/src/nm-openconnect-service.h
2019-08-06 13:34:19.000000000 +0200
+++ NetworkManager-openconnect-1.2.10/src/nm-openconnect-service.h
2023-06-27 15:31:37.948464134 +0200
@@ -31,6 +31,7 @@
 #define NM_IS_OPENCONNECT_PLUGIN(obj)
(G_TYPE_CHECK_INSTANCE_TYPE ((obj), NM_TYPE_OPENCONNECT_PLUGIN))
 #define NM_IS_OPENCONNECT_PLUGIN_CLASS(klass)
(G_TYPE_CHECK_CLASS_TYPE ((klass), NM_TYPE_OPENCONNECT_PLUGIN))
 #define NM_OPENCONNECT_PLUGIN_GET_CLASS(obj)
(G_TYPE_INSTANCE_GET_CLASS ((obj), NM_TYPE_OPENCONNECT_PLUGIN,
NMOpenconnectPluginClass))
+#define MAX_ARGS_LENGTH 1024

 typedef struct {
  NMVpnServicePlugin parent;


From Matthew_Mah at hms.harvard.edu  Tue Jul 25 22:17:08 2023
From: Matthew_Mah at hms.harvard.edu (Mah, Matthew Yew Mun)
Date: Wed, 26 Jul 2023 05:17:08 +0000
Subject: AnyConnect CSD debugging
Message-ID: <BL0PR07MB4130DC83BEE78801C92B2EA6CF00A@BL0PR07MB4130.namprd07.prod.outlook.com>

Hello, 

I am using OpenSUSE tumbleweed with openconnect 9.12-1.2 through the KDE network manager to connect to a Cisco AnyConnect VPN using two-factor authentication with Duo. This was working until the VPN server side recently changed to require running the CSD trojans, and I have been unsuccessful at reconfiguring the VPN client. As requested in the documentation, I am seeking help debugging this issue. 

This is the message that I read as requiring the CSD trojan:
Error: Server asked us to run CSD hostscan.
You need to provide a suitable --csd-wrapper argument.

I tried to configure the network manager setting "Allow Cisco Secure Desktop trojan" and setting the csd-post.sh modified to include "set -x" on line 2 as the CSD wrapper. 

I tried this both with and without the User Agent string "AnyConnect". 

Below is the slightly anonymized contents of the debug log, with the csd-post.sh script. 

Thanks for any help you can provide. 

POST https://vpn.example.org/
Attempting to connect to server a.b.c.d:443
Connected to a.b.c.d:443
SSL negotiation with vpn.example.org
Connected to HTTPS on vpn.example.org with ciphersuite (TLS1.2)-(ECDHE-SECP256R1)-(RSA-SHA512)-(AES-256-GCM)
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-store
Pragma: no-cache
Connection: Keep-Alive
Date: Tue, 25 Jul 2023 22:36:23 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' https://api-1234.duosecurity.com/ 'unsafe-inline' 'unsafe-eval' data: blob:; frame-ancestors 'self'
X-Aggregate-Auth: 1
HTTP body chunked (-2)
XML POST enabled
Trying to run CSD Trojan script '/home/username/csd-post.sh'.
CSD script '/home/username/csd-post.sh' completed successfully.
GET https://vpn.example.org/+CSCOE+/sdesktop/wait.html
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-store
Pragma: no-cache
Connection: Close
Date: Tue, 25 Jul 2023 22:36:24 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' https://api-1234.duosecurity.com/ 'unsafe-inline' 'unsafe-eval' data: blob:; frame-ancestors 'self'
HTTP body chunked (-2)
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
GET https://vpn.example.org/+CSCOE+/sdesktop/wait.html
SSL negotiation with vpn.example.org
Connected to HTTPS on vpn.example.org with ciphersuite (TLS1.2)-(ECDHE-SECP256R1)-(RSA-SHA512)-(AES-256-GCM)
Got HTTP response: HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: no-store
Pragma: no-cache
Connection: Close
Date: Tue, 25 Jul 2023 22:36:26 GMT
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1
Content-Security-Policy: default-src 'self' https://api-1234.duosecurity.com/ 'unsafe-inline' 'unsafe-eval' data: blob:; frame-ancestors 'self'
HTTP body chunked (-2)
Refreshing +CSCOE+/sdesktop/wait.html after 1 second...
GET https://vpn.example.org/+CSCOE+/sdesktop/wait.html
SSL negotiation with vpn.example.org

From Lisa.Binder at diehl-defence.com  Sun Jul 30 23:59:50 2023
From: Lisa.Binder at diehl-defence.com (Lisa BINDER)
Date: Mon, 31 Jul 2023 06:59:50 +0000
Subject: OpenConnect supported network security standards
Message-ID: <acf262d698b24835b03e66ff780d773e@diehl-defence.com>

Dear OpenConnect Dev Team,

The Cisco AnyConnect VPN Client supports the IEEE 802.1AE standard which allows to perform downlink MACsec between a client and a switch.
Does OpenConnect also support this feature or does it only focus on the VPN functionality of Cisco Anyconnect?

Best regards,
Lisa Binder?





 Lisa BINDER 

Diehl Defence GmbH & Co. KG 
Alte Nu?dorfer Stra?e 13 
88662 ?berlingen 

Telefon: +49 7551 89 6581
Telefax: +49 7551 89 6388
E-Mail: lisa.binder at diehl-defence.com
Web: http://www.diehl.com

----------------------------
Der Inhalt der vorstehenden E-Mail ist nicht rechtlich bindend. Diese E-Mail enth?lt vertrauliche und/oder rechtlich gesch?tzte Informationen. Informieren Sie uns bitte, wenn Sie diese E-Mail f?lschlicherweise erhalten haben. Bitte l?schen Sie in diesem Fall die Nachricht. Jede unerlaubte Form der Reproduktion, Bekanntgabe, ?nderung, Verteilung und/oder Publikation dieser E-Mail ist strengstens untersagt.
Informationen zum Datenschutz, insbesondere zu Ihren Rechten, erhalten Sie unter https://www.diehl.com/group/de/transparenz-und-informationspflichten/.

The content of the above mentioned e-mail is not legally binding. This e-mail contains confidential and/or legally protected information. Please inform us if you have received this e-mail by mistake and delete it in such a case. Each unauthorized reproduction, disclosure, alteration, distribution and/or publication of this e-mail is strictly prohibited. 
For general information on data protection and your respective rights please visit https://www.diehl.com/group/en/transparency-and-information-obligations/.
 
Diehl Defence GmbH & Co. KG
Sitz der Gesellschaft: ?berlingen - Amtsgericht Freiburg i. Br. HRA 581075
Pers?nlich haftende Gesellschafterin: Diehl Defence Verwaltungs-GmbH
Sitz der Gesellschaft: ?berlingen - Amtsgericht Freiburg i. Br. HRB 581694
Gesch?ftsf?hrer:
Dipl.-Ing. Helmut Rauch (Sprecher),
Dipl.-Betriebsw. Thomas Bodenm?ller,
Dipl.-Ing. Harald Buschek, Ph.D.,
Dipl.-Ing. Frank Kienzler, MBA


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 8077 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/openconnect-devel/attachments/20230731/3d5cc7ad/attachment.p7s>

From dlenski at gmail.com  Mon Jul 31 06:50:27 2023
From: dlenski at gmail.com (Daniel Lenski)
Date: Mon, 31 Jul 2023 09:50:27 -0400
Subject: OpenConnect supported network security standards
In-Reply-To: <acf262d698b24835b03e66ff780d773e@diehl-defence.com>
References: <acf262d698b24835b03e66ff780d773e@diehl-defence.com>
Message-ID: <CAOw_LSFV5WaR7LXcEiUpqZx4fNhQc4WC6KVp8LE+3VOzXVmZtg@mail.gmail.com>

On Mon, Jul 31, 2023 at 3:00?AM Lisa BINDER
<Lisa.Binder at diehl-defence.com> wrote:
>
> The Cisco AnyConnect VPN Client supports the IEEE 802.1AE standard which allows to perform downlink MACsec between a client and a switch.
> Does OpenConnect also support this feature or does it only focus on the VPN functionality of Cisco Anyconnect?

OpenConnect does not support 802.1AE/MACsec.

I don't understand why Cisco client software supports *both* the VPN
functionality (Layer 3 authentication, encryption, and tunnelling) as
well as MACsec (Layer 2 authentication and encryption).

Daniel


From dlenski at gmail.com  Mon Jul 31 06:52:49 2023
From: dlenski at gmail.com (Daniel Lenski)
Date: Mon, 31 Jul 2023 09:52:49 -0400
Subject: AnyConnect CSD debugging
In-Reply-To: <BL0PR07MB4130DC83BEE78801C92B2EA6CF00A@BL0PR07MB4130.namprd07.prod.outlook.com>
References: <BL0PR07MB4130DC83BEE78801C92B2EA6CF00A@BL0PR07MB4130.namprd07.prod.outlook.com>
Message-ID: <CAOw_LSHpkqEfcwrWug4-QOGaJ5GAD_eisgmL6Thx8_HRmmf6ag@mail.gmail.com>

On Wed, Jul 26, 2023 at 1:17?AM Mah, Matthew Yew Mun
<Matthew_Mah at hms.harvard.edu> wrote:
> I am using OpenSUSE tumbleweed with openconnect 9.12-1.2 through the KDE network manager to connect to a Cisco AnyConnect VPN using two-factor authentication with Duo. This was working until the VPN server side recently changed to require running the CSD trojans, and I have been unsuccessful at reconfiguring the VPN client. As requested in the documentation, I am seeking help debugging this issue.

Please connect using the command-line OpenConnect client (start with
'openconnect -vvv --dump-http-traffic
--csd-wrapper=/path/to/csd-post.sh'), which makes it much easier to
debug connection problems, and share the results here.

Thanks,
Daniel


From rada611 at gmail.com  Mon Jul 31 10:21:23 2023
From: rada611 at gmail.com (rada611 at gmail.com)
Date: Mon, 31 Jul 2023 20:21:23 +0300
Subject: Analogue profiles AnyConnect
Message-ID: <CAOZmQnpqdU9uW1_PB5nFWHW62JjjCMuQRuRvOsD8dqTvbo_aDw@mail.gmail.com>

Heya! Deploying OCserv to replace Cisco AnyConnect (company doesn't
want to renew support anymore, moving to free software). Anyconnect
has profiles configured. That is, when profiles are selected, certain
subnets become available to a group of users from Active Directory.
Tell me how to make similar profiles in OCserv. I didn't find the
information on the Internet, I searched for several days. My CIO
refuses to believe that this is not possible with OCserv )


Kind regards,
Alexander Morozov


